Comcast Uses Man-in-the-Middle Attack To Nag Customers About Pirated Content
If one of its customers is found to be downloading or sharing content that has been flagged as infringing on copyrighted material, Comcast uses a man-the-middle attack to inject a “popup” warning message into your browser in an effort to persuade you from further pursuing illegal activities. While Comcast’s efforts to combat piracy are admirable, using a man-in-the-middle attack, which allows the ISP to hijack traffic flowing from a customer’s computer to an intended server, is definitely shady business.
Comcast sees this move as a much-needed lynchpin in its efforts to set its customers straight with regards to copyright infringement. However, Jarred Sumner, the developer that posted Comcast's offending code to Github, says that ISP's actions could have huge implications on user privacy.
“Comcast [could] modify unencrypted traffic in both directions,” said Sumner. “This is highly dubious behavior from Comcast. The last thing anyone wants is unapproved third-party JavaScript libraries being injected onto their pages. This could have serious performance and security implications.
"There are scarier scenarios where this could be used as a tool for censorship, surveillance, [or] selling personal information.”
Although this all seems like shocking behavior on the part of Comcast, it’s not unprecedented. Comcast using similar tactics to deliver in-browser messages to customers that are coming close to or have already surpassed their allotted bandwidth for the month (those bandwidth caps are coming to more and more cities across the United States). As for Comcast, it says that this is all old news — it published a white paper back in 2011 detailing its Internet Engineering Task Force and its ability to use such tactics to get the attention of its customers.
